Windows SMB EUVD-2026-44019

Exploitation requires the attacker to have an existing authenticated local session on the target Windows system, consistent with the CVSS vector PR:L (low-privilege authenticated) and AV:L (local attack vector). No special non-default configuration of SMB is indicated - the SMB driver is enabled by default on all listed Windows versions, meaning any authenticated local user on an unpatched system meets the preconditions. Exploitation is limited to information disclosure only (C:H/I:N/A:N); the attacker cannot write to memory or cause a denial of service through this specific vulnerability. The requirement for local access is the primary limiting factor - remote, unauthenticated exploitation across the network is not possible based on the provided CVSS vector.

The CVSS 3.1 base score of 5.5 (Medium) reflects a local, low-privilege attack yielding high confidentiality impact but no integrity or availability impact, which is an accurate characterization. The AV:L vector is the primary risk limiter - the attacker must already have an authenticated session on the target host, reducing the exposed attack surface to insider threats, compromised accounts, or post-exploitation lateral movement scenarios. No EPSS data was provided in the intelligence feed, and the vulnerability is not listed in the CISA KEV catalog, confirming no observed active exploitation. No proof-of-concept code has been identified. Real-world prioritization should be moderate: this is a genuine information disclosure that could assist privilege escalation chains (e.g., leaking kernel pointers to defeat ASLR), but it is not independently high-impact and requires an existing foothold. The absence of EPSS data is a gap; defenders should not treat 'no EPSS provided' as equivalent to 'low EPSS.'

An attacker with a low-privileged local account on a Windows system - gained through phishing, credential theft, or initial compromise - issues a crafted request to the SMB driver via a local API or device control call, triggering the uninitialized memory read path. The leaked memory contents, which may include kernel pointers or sensitive data from other processes, are returned to the attacker's process. No public proof-of-concept exists at time of analysis, so active exploitation in this manner has not been observed.